Computer Forensics, Data Recovery and E-Discovery Differ

What’s the difference between data recovery, computer forensics and e-discovery?

All three fields deal with data, and specifically digital data. It’s all about electrons in the form of zeroes and ones. And it’s all about taking information that may be hard to find and presenting it in a readable fashion. But even though there is overlap, the skill sets require different tools, different specializations, different work environments, and different ways of looking at things.

Data recovery generally involves things that are broken – whether hardware or software. When a computer crashes and won’t start back up, when an external hard disk, thumb drive, or memory card becomes unreadable, then data recovery may be required. Frequently, a digital device that needs its data recovered will have electronic damage, physical damage, or a combination of the two. If such is the case, hardware repair will be a big part of the data recovery process. This may involve repairing the drive’s electronics, or even replacing the stack of read / write heads inside the sealed portion of the disk drive.

If the hardware is intact, the file or partition structure is likely to be damaged. Some data recovery tools will attempt to repair partition or file structure, while others look into the damaged file structure and attempt to pull files out. Partitions and directories may be rebuilt manually with a hex editor as well, but given the size of modern disk drives and the amount of data on them, this tends to be impractical.

By and large, data recovery is a kind of “macro” process. The end result tends to be a large population of data saved without as much attention to the individual files. Data recovery jobs are often individual disk drives or other digital media that have damaged hardware or software. There are no particular industry-wide accepted standards in data recovery.

Electronic discovery usually deals with hardware and software that is intact. Challenges in e-discovery include “de-duping.” A search may be conducted through a very large volume of existing or backed-up emails and documents.

Due to the nature of computers and of email, there are likely to be very many identical duplicates (“dupes”) of various documents and emails. E-discovery tools are designed to winnow down what might otherwise be an unmanageable torrent of data to a manageable size by indexing and removal of duplicates, also known as de-duping.

E-discovery often deals with large quantities of data from undamaged hardware, and procedures fall under the Federal Rules of Civil Procedure (“FRCP”).

Computer forensics has aspects of both e-discovery and data recovery.

In computer forensics, the forensic examiner (CFE) searches for and through both existing and previously existing, or deleted data. Doing this kind of e-discovery, a forensics expert sometimes deals with damaged hardware, although this is relatively uncommon. Data recovery procedures may be brought into play to recover deleted files intact. But frequently the CFE must deal with purposeful attempts to hide or destroy data that require skills outside those found in the data recovery industry.

When dealing with email, the CFE is often searching unallocated space for ambient data – data that no longer exists as a file readable to the user. This can include searching for specific words or phrases (“keyword searches”) or email addresses in unallocated space. This can include hacking Outlook files to find deleted email. This can include looking into cache or log files, or even into Internet history files for remnants of data. And of course, it often includes a search through active files for the same data.

Practices are similar when looking for specific documents supportive of a case or charge. Keyword searches are performed both on active or visible documents, and on ambient data. Keyword searches must be designed carefully. In one such case, Schlinger Foundation v Blair Smith the author uncovered more than one million keyword “hits” on two disk drives.

Finally, the computer forensics expert is also often called upon to testify as an expert witness in deposition or in court. As a result, the CFE’s methods and procedures may be put under a microscope and the expert may be called upon to explain and defend his or her results and actions. A CFE who is also an expert witness may have to defend things said in court or in writings published elsewhere.

Most often, data recovery deals with one disk drive, or the data from one system. The data recovery house will have its own standards and procedures and works on reputation, not certification. Electronic discovery frequently deals with data from large numbers of systems, or from servers with that may contain many user accounts. E-discovery methods are based on proven software and hardware combinations and are best planned for far in advance (although lack of pre-planning is very common). Computer forensics may deal with one or many systems or devices, may be fairly fluid in the scope of demands and requests made, often deals with missing data, and must be defensible – and defended – in court.


Related Posts

Gwen Josephine

Next Post

Integer Programming

Thu Apr 21 , 2022
A linear programming problem is used to find either the maximum or minimum of an objective function subject to some constraints. These constraints are usually inequalities. When these constraints are satisfied one obtains a feasible solution. When one of these solutions is either the maximum or the minimum as per […]

You May Like

Finance management Business development Business strategy Business operations Business management Business growth Business analysis Industry trends Financial analysis Industry insights Industry challenges Manufacturing process Manufacturing industry Manufacturing technologies Parenting Family Journalism Lifestyle blog Current events Breaking news Media coverage Educational trends Scientific community STEM (Science, Technology, Engineering, and Mathematics) Legal support team Legal regulations compliance Intellectual property laws Career success Education software Online learning platforms Civil rights protection Corporate legal compliance Legal guidance blog Cybersecurity Social media marketing Digital transformation Network infrastructure Internet of Things (IoT) Web development Software maintenance Software engineering Mobile apps E-commerce platforms User experience (UX) design User interface (UI) design Responsive web design Artificial intelligence (AI) Car accessories Automotive engineering Car maintenance Adventure travel Car technology Vehicle Automotive trends Automotive industry analysis Car brands Healthy lifestyle Nutrition and wellness Dermatology services Cosmetic procedures Plastic surgery Alternative medicine Fitness exercises Mental health Yoga and meditation Oral health Fashion Women's fashion Skincare routine Wedding flowers Fashion accessories Online fashion community Online shopping Fashion tips Pet Health Services Veterinary Care Shelter and Rescue Home renovation ideas Interior design inspiration Home decor trends mart home technology Real estate market trends Rental property management Gardening and landscaping tips Home remodeling and renovations Moving and packing services Professional home cleaning furniture and accessories Art and design workshops Art and culture events Art festivals and fairs Visual arts and crafts Outdoor adventures Sports events sports Gaming community Outdoor family activities Gastronomy Food tourism Food exploration Vacation Holiday Tourist Attractions Travel destinations Leisure activities Weekend getaway Travel experiences News reporting Residential services Big Data Real estate agent selection Parenting Guides Pool maintenance and cleaning Fashion industry news health shop Data analytics Community Press release zoom news info Health and wellness tips data macau travel Medical treatments school trips plus uk Legal assistance Parenting Tips puppy love pets uk Automotive manufacturing Exterior home improvement Travel tips Headlines Food culture Automotive industryCriminal Law Healthcare services school Trip sports Equipment dental Beauty Education International